Coding agents work better than their counterparts because the labs can post train their frontier model inside of a harness. The reason is the environment, not the model. A codebase hands an agent many things nobody had to design: a way to undo mistakes, a way to grade its own work, effectively get to peek at the effects of its action in the enviornment it's in. git reset covers the first. The test suite covers the second. Logs. Traces. Containers. The agent writes something wrong, sees red, and fixes it.
Dex Horothy, Co-Founder HumanLayer. Calls this sort of idea back pressure.
Rails is the product, the box is the agent
The agent runs inside an E2B sandbox, one per user, a microVM with its own disk. The loop inside it is the Claude Agent SDK, the engine behind Claude Code, used as a library. Rails keeps the parts a sandbox should never hold: the database, the credentials, the UI, and the record of what happened.
Rails 8 + Postgres product, safety, system of record
| drives and proxies over HTTP
v
E2B sandbox one per user, paused between runs
+-- agent process the SDK loop, running IN the box
+-- /memory learned preferences, contacts
+-- /scripts tools the agent writes for itself
+-- /workspace per-run scratch
+-- REPL a long-lived Python process
Bash, Grep, and Read hit local disk at local speed. The agent has a computer, not a remote drive it makes calls against.
Rails drives the sandbox over plain REST with Faraday, so there is no second deployable and no Python service to operate. The only Python in the system is baked into the box image.
Containment, rebuilt
The worst case for a coding agent is a broken build. Ours is a real email to a real person.
Egress is default deny. The box may reach two hosts: the Rails app and the model API. It cannot call Google, GitHub, or Pipedream directly, whatever it decides to try.
Credentials never enter the box. Every tool the agent calls is a shim that posts back to a Rails proxy. Rails validates the caller, adds the user's OAuth tokens, calls the connector, and returns a sanitized result. The firewall covers the whole toolset, not just one action, because Rails serves the tool manifest from the same Ruby classes the in-process agent already used.
Run tokens are scoped and short. Each run carries a signed token naming the user, the scope, and a thirty minute expiry. The worst a compromised box can do is replay that token at Rails, which checks it and says no.
The box holds no long-lived secret. E2B snapshots the daemon at build time, so environment variables injected at create time never reach it. The model key arrives in the per-turn message body and dies with the turn. Nothing sensitive is ever written to a disk that gets snapshotted.
Because no credential touches the filesystem, the filesystem is safe to keep. That is what makes memory possible at all.
The grader, manufactured
There is no assertion that says an email draft is correct, so we assemble a substitute from three parts.
The user's approval is the test suite. Tools write a Plan row that renders as a discrete artifact in the chat. Nothing irreversible runs until the user approves it, and a run that emits a plan finishes as awaiting_plan rather than completed.
Corrections become the regression suite. "Never CC my boss" lands in /memory/preferences/ and constrains every run after it.
A critic subagent stands in for the tests that do not exist. It reviews the drafter's work in an isolated context before a plan surfaces. Subagents are first class in the SDK, so this is configuration rather than infrastructure. This one is designed and not yet built.
Storage in tiers
Context is the scarce resource, so state lives at the cheapest tier that can hold it.
| Tier | Where | Lifetime |
|---|---|---|
| 0 | Context window | One API call |
| 1 | REPL variables | Survives pause and resume |
| 2 | Filesystem | Snapshotted with the box |
| 3 | Blob and SQLite | Durable, unbuilt |
Tier 1 is the one that changes the economics, and it gets its own post. Tier 2 is a filesystem the agent greps, with no embeddings and no vector database. Grep over raw files beats semantic retrieval on hard tasks, and it costs nothing to operate.
What held
Pause snapshots RAM as well as disk, so the daemon process and its live variables survive a sleep and come back in about 280 milliseconds. The box is genuinely still there, rather than rebuilt from scratch. Egress held. The credential firewall is real.
A live task ran the whole arc: search the connector catalog, run a Google Jobs action, wrangle the results, send the email through Gmail.
What remains is honest to name. Cross-run memory read-back is unverified. The blob tier is unbuilt. The trust ramp that drafts instead of sending is designed and not written, so run_action executes when the agent calls it.
The lesson is general. Before you point a coding agent at work that is not code, list what the codebase was giving it for free: git reset, the test suite, the logs and traces that show the effect of its actions. Outside the codebase you supply all of that yourself, give the agent a bumper car.